ci: publish to crates.io on release tag

[0x5ea000000]

Summary

Adds a publish-crate job to the release workflow so each v* tag automatically publishes the crate to crates.io alongside the binary release.

• Runs after the build matrix succeeds, so a broken build is never published
• Verifies the tag version matches the version in Cargo.toml (fails the job on mismatch instead of publishing a stale version)
• Publishes with cargo publish --locked using the committed Cargo.lock
• Actions pinned by SHA, matching the rest of the workflow

Setup required

A crates.io API token (scope: publish-update) must be added as the CARGO_REGISTRY_TOKEN repository secret before the next release tag.